@elizaos/agent 2.0.0-alpha.519 → 2.0.0-alpha.521

package/packages/app-core/src/api/auth-client.js

@@ -1,301 +0,0 @@
-/**
- * Typed client for P1 session auth endpoints.
- *
- * All state-changing calls go through `fetchWithCsrf` so the CSRF header is
- * attached automatically. GET requests use plain `fetch` with
- * `credentials: "include"`.
- *
- * This module is UI-only. It deliberately does NOT import ElizaClient so it
- * can be used in auth-gated components before the main client is initialised.
- */
-import { fetchWithCsrf } from "./csrf-client";
-// ── API base helper ───────────────────────────────────────────────────────────
-/**
- * Resolves the base URL for auth calls. Reads from the same source as the
- * main ElizaClient so they stay in sync.
- */
-function authBase() {
-    if (typeof window === "undefined")
-        return "";
-    // Prefer the boot-config override (set by deep-link / dev server).
-    try {
-        const { getBootConfig } = require("../config/boot-config");
-        const cfg = getBootConfig();
-        if (cfg.apiBase)
-            return cfg.apiBase.replace(/\/$/, "");
-    }
-    catch {
-        // Module not available in test environments that stub the config.
-    }
-    return window.location.origin;
-}
-// ── Endpoint callers ──────────────────────────────────────────────────────────
-/**
- * POST /api/auth/setup — first-run owner identity creation.
- * Returns 409 if an owner identity already exists.
- */
-export async function authSetup(params) {
-    let res;
-    try {
-        res = await fetchWithCsrf(`${authBase()}/api/auth/setup`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(params),
-        });
-    }
-    catch (err) {
-        return {
-            ok: false,
-            status: 500,
-            reason: "server_error",
-            message: err instanceof Error ? err.message : "Network error",
-        };
-    }
-    if (res.ok) {
-        const body = (await res.json());
-        return { ok: true, ...body };
-    }
-    const body = (await res.json().catch(() => ({})));
-    const reason = body.reason ?? body.error ?? "";
-    if (res.status === 409) {
-        return {
-            ok: false,
-            status: 409,
-            reason: "already_initialized",
-            message: "An owner account already exists.",
-        };
-    }
-    if (res.status === 429) {
-        return {
-            ok: false,
-            status: 429,
-            reason: "rate_limited",
-            message: "Too many attempts — wait a moment and try again.",
-        };
-    }
-    if (res.status === 400 && reason === "weak_password") {
-        return {
-            ok: false,
-            status: 400,
-            reason: "weak_password",
-            message: "Password too weak. Use at least 12 characters with a mix of letters, numbers, and symbols.",
-        };
-    }
-    if (res.status === 400) {
-        return {
-            ok: false,
-            status: 400,
-            reason: "invalid_display_name",
-            message: "Display name must be 1–64 characters (letters, numbers, spaces, _ . - @).",
-        };
-    }
-    return {
-        ok: false,
-        status: 500,
-        reason: "server_error",
-        message: `Unexpected error (${res.status})`,
-    };
-}
-/**
- * POST /api/auth/login/password — password-based login.
- */
-export async function authLoginPassword(params) {
-    let res;
-    try {
-        res = await fetchWithCsrf(`${authBase()}/api/auth/login/password`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(params),
-        });
-    }
-    catch (err) {
-        return {
-            ok: false,
-            status: 500,
-            reason: "server_error",
-            message: err instanceof Error ? err.message : "Network error",
-        };
-    }
-    if (res.ok) {
-        const body = (await res.json());
-        return { ok: true, ...body };
-    }
-    if (res.status === 429) {
-        return {
-            ok: false,
-            status: 429,
-            reason: "rate_limited",
-            message: "Too many attempts — wait a moment and try again.",
-        };
-    }
-    return {
-        ok: false,
-        status: res.status === 401 ? 401 : 500,
-        reason: res.status === 401 || res.status === 400
-            ? "invalid_credentials"
-            : "server_error",
-        message: res.status === 401 || res.status === 400
-            ? "Invalid display name or password."
-            : `Unexpected error (${res.status})`,
-    };
-}
-/**
- * POST /api/auth/logout — destroys the current session.
- */
-export async function authLogout() {
-    try {
-        await fetchWithCsrf(`${authBase()}/api/auth/logout`, { method: "POST" });
-    }
-    catch {
-        // Logout is best-effort; treat network errors as success from the
-        // client's perspective — the cookie may still clear on reconnect.
-    }
-    return { ok: true };
-}
-/**
- * GET /api/auth/me — returns the current identity + session, or 401.
- *
- * Fail closed: network errors are treated as 401 so the login gate renders.
- */
-export async function authMe() {
-    let res;
-    try {
-        res = await fetch(`${authBase()}/api/auth/me`, {
-            credentials: "include",
-        });
-    }
-    catch {
-        return { ok: false, status: 401 };
-    }
-    if (res.ok) {
-        const body = (await res.json());
-        return {
-            ok: true,
-            identity: body.identity,
-            session: body.session,
-            access: body.access ?? {
-                mode: "session",
-                passwordConfigured: true,
-                ownerConfigured: true,
-            },
-        };
-    }
-    if (res.status === 401) {
-        const body = (await res.json().catch(() => ({})));
-        return {
-            ok: false,
-            status: 401,
-            reason: body.reason === "remote_password_not_configured"
-                ? "remote_password_not_configured"
-                : body.reason === "remote_auth_required"
-                    ? "remote_auth_required"
-                    : "server_error",
-            access: body.access,
-        };
-    }
-    return {
-        ok: false,
-        status: res.status === 503 ? 503 : 401,
-    };
-}
-/**
- * GET /api/auth/sessions — lists active sessions for the current identity.
- */
-export async function authListSessions() {
-    let res;
-    try {
-        res = await fetch(`${authBase()}/api/auth/sessions`, {
-            credentials: "include",
-        });
-    }
-    catch {
-        return { ok: false, status: 401 };
-    }
-    if (res.ok) {
-        const body = (await res.json());
-        return { ok: true, sessions: body.sessions };
-    }
-    return {
-        ok: false,
-        status: res.status === 503 ? 503 : 401,
-    };
-}
-/**
- * POST /api/auth/sessions/:id/revoke — revokes one session.
- */
-export async function authRevokeSession(sessionId) {
-    let res;
-    try {
-        res = await fetchWithCsrf(`${authBase()}/api/auth/sessions/${encodeURIComponent(sessionId)}/revoke`, { method: "POST" });
-    }
-    catch {
-        return { ok: false, status: 500 };
-    }
-    if (res.ok)
-        return { ok: true };
-    if (res.status === 404)
-        return { ok: false, status: 404 };
-    if (res.status === 401)
-        return { ok: false, status: 401 };
-    return { ok: false, status: 500 };
-}
-export async function authChangePassword(params) {
-    let res;
-    try {
-        res = await fetchWithCsrf(`${authBase()}/api/auth/password/change`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(params),
-        });
-    }
-    catch (err) {
-        return {
-            ok: false,
-            status: 500,
-            reason: "server_error",
-            message: err instanceof Error ? err.message : "Network error",
-        };
-    }
-    if (res.ok)
-        return { ok: true };
-    const body = (await res.json().catch(() => ({})));
-    const reason = body.reason ?? body.error ?? "";
-    if (res.status === 400 && reason === "weak_password") {
-        return {
-            ok: false,
-            status: 400,
-            reason: "weak_password",
-            message: "Password too weak. Use at least 12 characters with a mix of letters, numbers, and symbols.",
-        };
-    }
-    if (res.status === 401) {
-        return {
-            ok: false,
-            status: 401,
-            reason: "invalid_credentials",
-            message: "Current password is incorrect.",
-        };
-    }
-    if (res.status === 404) {
-        return {
-            ok: false,
-            status: 404,
-            reason: "owner_not_found",
-            message: "No owner account exists yet.",
-        };
-    }
-    if (res.status === 429) {
-        return {
-            ok: false,
-            status: 429,
-            reason: "rate_limited",
-            message: "Too many attempts — wait a moment and try again.",
-        };
-    }
-    return {
-        ok: false,
-        status: 500,
-        reason: "server_error",
-        message: `Unexpected error (${res.status})`,
-    };
-}

package/packages/app-core/src/api/auth.d.ts

@@ -1,155 +0,0 @@
-/**
- * API authentication helpers extracted from server.ts.
- *
- * Centralises token extraction from multiple header formats and
- * timing-safe comparison so route handlers don't reimplement it.
- */
-import type http from "node:http";
-export { tokenMatches } from "./auth/tokens";
-/**
- * Normalise a potentially multi-valued HTTP header into a single string.
- * Returns `null` when the header is absent or empty.
- */
-export declare function extractHeaderValue(value: string | string[] | undefined): string | null;
-/**
- * Read the configured API token from env (`ELIZA_API_TOKEN` / `ELIZA_API_TOKEN`).
- * Returns `null` when no token is configured (open access).
- */
-export declare function getCompatApiToken(): string | null;
-/**
- * Extract the API token from an incoming request.
- *
- * Checks (in order):
- *   1. `Authorization: Bearer <token>`
- *   2. `x-eliza-token`
- *   3. `x-elizaos-token`
- *   4. `x-api-key` / `x-api-token`
- */
-export declare function getProvidedApiToken(req: Pick<http.IncomingMessage, "headers">): string | null;
-/** Clear all auth rate limit state. Exported for test use only. */
-export declare function _resetAuthRateLimiter(): void;
-/**
- * Gate a request behind the configured API token (sync, bearer-only).
- *
- * Use this only on cold paths where no `AuthStore` exists yet (boot
- * sequence, or before plugin-sql has attached its adapter). Every route
- * that runs after the runtime is up should use
- * {@link ensureCompatApiAuthorizedAsync} instead, which understands
- * session cookies + CSRF.
- */
-export declare function ensureCompatApiAuthorized(req: Pick<http.IncomingMessage, "headers" | "socket">, res: http.ServerResponse): boolean;
-/**
- * Cookie-aware authorisation gate. Tries (in order):
- *   1. valid `milady_session` cookie → session in DB → authorised.
- *   2. configured static bearer (legacy) → 14-day grace window via
- *      `decideLegacyBearer`; emits the deprecation header on success.
- *   3. open-access fallback when no token is configured.
- *
- * For cookie-bound sessions, state-changing methods (POST/PUT/PATCH/DELETE)
- * MUST present a valid `x-milady-csrf` header that matches the per-session
- * `csrfSecret` derivation. Reject 403 otherwise. Bearer-auth requests are
- * exempt (not cookie-bound, so no CSRF risk).
- *
- * Returns `true` when the request may proceed; `false` after sending a
- * 401/403/429.
- *
- * Caller supplies an `AuthStore` because importing one here would create a
- * cycle with `services/auth-store.ts`. Routes typically construct one
- * once per handler.
- */
-export declare function ensureCompatApiAuthorizedAsync(req: Pick<http.IncomingMessage, "headers" | "socket" | "method">, res: http.ServerResponse, options: {
-    store: import("../services/auth-store").AuthStore;
-    now?: number;
-    /**
-     * Skip CSRF enforcement for routes that ALWAYS handle CSRF themselves
-     * (e.g. login routes that mint the cookie, where there is no prior
-     * session to derive a token from). Default: false — enforce CSRF.
-     */
-    skipCsrf?: boolean;
-}): Promise<boolean>;
-/** Returns true when NODE_ENV indicates a local development environment. */
-export declare function isDevEnvironment(): boolean;
-/** Cookie name used by the session model. Exported for tests + UI client. */
-export declare function getSessionCookieName(): string;
-/**
- * Read the named cookie from the `cookie` header. Returns `null` when the
- * header is missing or the cookie is not set.
- *
- * Pulled out here so route handlers don't reimplement parsing — the existing
- * `compat-route-shared.ts` predates the cookie-based session model.
- */
-export declare function readCookie(req: Pick<http.IncomingMessage, "headers">, name: string): string | null;
-/**
- * Resolved auth context for a sensitive request.
- *
- * `kind === "session"` — request carries a valid session cookie / bearer that
- * resolves to an unrevoked, unexpired session row.
- *
- * `kind === "bootstrap"` — request carries a one-shot bootstrap token. The
- * token has been verified and its `jti` consumed; the caller is expected to
- * mint a session row for the identity in `claims.sub` and reply with the
- * session id.
- *
- * `kind === "denied"` — request is rejected. The handler must send 401/403/429
- * per `status` and not proceed.
- */
-export type AuthSessionOrBootstrapResult = {
-    kind: "session";
-    sessionId: string;
-} | {
-    kind: "bootstrap";
-    token: string;
-    bearer: string;
-} | {
-    kind: "denied";
-    status: 401 | 403 | 429;
-    reason: string;
-};
-/**
- * Decide whether a request carries a valid session cookie or a bootstrap
- * bearer eligible for exchange. This is the single chokepoint that replaces
- * the deleted "cloud-provisioned bypass" branches.
- *
- * The function does NOT exchange the bootstrap token here — that's the job
- * of `POST /api/auth/bootstrap/exchange`, which is rate-limited and audited.
- * On the legacy onboarding routes we treat a valid session OR an unconsumed
- * bootstrap bearer as authorisation to read; the exchange route is the
- * single place that flips bootstrap → session.
- *
- * Fails closed on every error path. There is no path through this function
- * that returns "session" without a real session row id.
- */
-export declare function ensureAuthSessionOrBootstrap(req: Pick<http.IncomingMessage, "headers" | "socket">): AuthSessionOrBootstrapResult;
-/**
- * Gate a sensitive route. Without a configured token, only trusted same-machine
- * dashboard requests are allowed. Remote callers need a real auth method.
- */
-export declare function ensureCompatSensitiveRouteAuthorized(req: Pick<http.IncomingMessage, "headers" | "socket">, res: http.ServerResponse): boolean;
-interface CompatStateLike {
-    current: {
-        adapter?: {
-            db?: unknown;
-        } | null;
-    } | null;
-}
-/**
- * Canonical async route guard. Replaces every call site of
- * {@link ensureCompatApiAuthorized}. Behaviour:
- *
- *   - When the runtime DB is up, delegate to
- *     {@link ensureCompatApiAuthorizedAsync} so cookie + CSRF +
- *     legacy-bearer + machine-session paths all work.
- *   - When the runtime DB is not yet available (early boot), fall back
- *     to {@link ensureCompatApiAuthorized} (bearer-only). This preserves
- *     the existing behaviour for cold boot probes that ran before the
- *     auth subsystem was available.
- *
- * Pass `skipCsrf: true` for routes that mint cookies / handle their own
- * CSRF (login, setup, bootstrap exchange) where the SPA cannot present a
- * CSRF token because the session doesn't exist yet.
- */
-export declare function ensureRouteAuthorized(req: Pick<http.IncomingMessage, "headers" | "socket" | "method">, res: http.ServerResponse, state: CompatStateLike, options?: {
-    skipCsrf?: boolean;
-    now?: number;
-}): Promise<boolean>;
-//# sourceMappingURL=auth.d.ts.map

package/packages/app-core/src/api/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../app-core/src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAYlC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,GAAG,IAAI,CAGf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GACzC,MAAM,GAAG,IAAI,CAgBf;AAOD,mEAAmE;AACnE,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAqCD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAqBT;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,OAAO,EAAE;IACP,KAAK,EAAE,OAAO,wBAAwB,EAAE,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,OAAO,CAAC,OAAO,CAAC,CAiGlB;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAMD,6EAA6E;AAC7E,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAYf;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,4BAA4B,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACpD,4BAA4B,CAqB9B;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,EACrD,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,OAAO,CAeT;AAED,UAAU,eAAe;IACvB,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAChE,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACjD,OAAO,CAAC,OAAO,CAAC,CAalB"}